AI drives 440% jump in onchain malware

TLDR

AI-assisted tools are coinciding with a sharp rise in malware that uses public blockchains as part of its infrastructure, with Chainalysis reporting roughly a 440% jump in such onchain malware writes.

1. Chainalysis found a 420440% increase in malicious data written to blockchains over the past year, largely driven by state-linked hackers from North Korea and Iran.
2. The surge closely tracks the release of powerful open source AI models that can generate malware code, making it faster and cheaper to produce new campaigns, though direct AI use is not proven.
3. Attackers now abuse chains like Bitcoin, Ethereum, Tron, Aptos and BNB Chain as resilient dead drops for command-and-control data, increasing long term risk for wallets, DeFi users and exchanges.

Deep Dive

1. What The 440% Jump Actually Is

Chainalysis reports that the number of times attackers store malware instructions or infrastructure details on public blockchains has risen about 420440% over the last 12 months, with state actors behind most of the growth.

North Korea and Iran linked groups account for roughly two thirds of this new activity, embedding encrypted routing data and server information in transactions on Bitcoin, Tron, Aptos and BNB Chain, according to the Chainalysis analysis summarized by Cointelegraph.

One campaign, tied to North Korea linked group UNC5342, used Tron and Aptos transactions to point infected machines to a specific BNB Chain transaction that held configuration data for remote access and data theft.

2. How AI Is Accelerating Malware

Chainalysis notes that the 440% increase in malicious blockchain writes began shortly after high capacity open source Chinese AI models became able to generate malicious code with minimal safeguards, providing a clear timing overlap.

Their cybercrime lead says there is clear point in time association between these AI releases and the surge, though they cannot yet prove that attackers directly used those models in every campaign.

Other research supports AI as a force multiplier: Anthropic and others have shown AI agents quickly finding exploitable smart contract bugs, and security leaders warn that small protocol teams now face adversaries who can iterate malware far faster than before.

3. How Onchain Malware Targets Crypto Users

Recent campaigns show how onchain malware directly intersects with crypto. Elastics KREMLIN malware uses Ethereum smart contracts as a dead drop to update attack servers without redeploying malware, as detailed in a technical report covered by crypto.news.

Another campaign hijacked HBO Maxs Reddit account to push malware that stole browser credentials and deployed crypto address clippers, while using Binance Smart Chain contracts as part of its command-and-control rotation, according to a CCN report.

These designs do not break consensus or steal funds directly from chains; instead they use blockchains as a permanent, censorship resistant bulletin board for malware instructions that ultimately target wallets, browsers and DeFi users offchain.

Confidence: high, based on the Chainalysis report and multiple independent security write ups from 20252026.

Conclusion

AI has made it easier for sophisticated actors to produce and maintain malware that leans on public blockchains for resilience, driving a large increase in onchain malware writes.

For crypto users and builders, the main shift is not a new exploit class but a faster, more automated version of existing threats that now blend onchain infrastructure with offchain phishing and malware.

Monitoring AI driven threats, hardening user devices and wallets, and adopting stronger verification and auditing practices will be key to keeping blockchains and DeFi usable as AI capabilities continue to advance.